github-issue-tower-defence-management 1.148.24 → 1.149.0

package/src/adapter/repositories/TranscriptSessionSubAgentActivityRepository.test.ts

@@ -279,6 +279,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 120,
         runningSeconds: 900,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -400,6 +401,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 60,
         runningSeconds: 600,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -474,6 +476,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 60,
         runningSeconds: 600,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -525,6 +528,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 600,
         runningSeconds: 900,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -555,6 +559,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: fourDaysSeconds,
         runningSeconds: fourDaysSeconds,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -592,6 +597,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 60,
         runningSeconds: 600,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
     fs.rmSync(targetDir, { force: true, recursive: true });
@@ -680,6 +686,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 0,
         runningSeconds: 0,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -731,6 +738,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 120,
         runningSeconds: 900,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -767,6 +775,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: twoDaysSeconds,
         runningSeconds: twoDaysSeconds,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -821,6 +830,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
             silentSeconds: 600,
             runningSeconds: 900,
             waitingOnExternalProcess: true,
+            finishedResultUnconsumed: false,
           },
         ]);
       },
@@ -956,6 +966,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
           silentSeconds: 600,
           runningSeconds: 900,
           waitingOnExternalProcess: true,
+          finishedResultUnconsumed: false,
         },
       ]);
     });
@@ -987,6 +998,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
           silentSeconds: 600,
           runningSeconds: 900,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ]);
     });
@@ -1282,6 +1294,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 120,
         runningSeconds: 900,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -1337,6 +1350,7 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 600,
         runningSeconds: 900,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });
@@ -1367,6 +1381,151 @@ describe('TranscriptSessionSubAgentActivityRepository', () => {
         silentSeconds: 120,
         runningSeconds: 900,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
+      },
+    ]);
+  });
+
+  it('reports a finished sub-agent still listed in the running-subagents record as an unconsumed result carrying its silence age', async () => {
+    const sessionName = 'https_//github_com/owner/repo/issues/9';
+    const unconsumedAgentId = 'aaabbbbcccc30001';
+    writeAgentTranscript(
+      sessionName,
+      unconsumedAgentId,
+      finishedEntries('2026-06-27T10:30:00.000Z'),
+      nowEpochSeconds - 5220,
+    );
+    const repository = new TranscriptSessionSubAgentActivityRepository(
+      createResolver(),
+      emptyProcessLister(),
+      now,
+      livenessResolverWith([unconsumedAgentId]),
+    );
+
+    const result = await repository.listSubAgentActivitiesBySessionName(
+      [sessionName],
+      transcriptMapFor([sessionName]),
+    );
+
+    expect(result.get(sessionName)).toEqual([
+      {
+        label: `agent-${unconsumedAgentId}`,
+        silentSeconds: 5220,
+        runningSeconds: 5400,
+        waitingOnExternalProcess: false,
+        finishedResultUnconsumed: true,
+      },
+    ]);
+  });
+
+  it('reports a finished sub-agent whose tail is a final text answer as an unconsumed result while it stays in the running-subagents record', async () => {
+    const sessionName = 'https_//github_com/owner/repo/issues/9';
+    const unconsumedAgentId = 'aaabbbbcccc30002';
+    writeAgentTranscript(
+      sessionName,
+      unconsumedAgentId,
+      finalTextAnswerEntries('2026-06-27T11:00:00.000Z'),
+      nowEpochSeconds - 360,
+    );
+    const repository = new TranscriptSessionSubAgentActivityRepository(
+      createResolver(),
+      emptyProcessLister(),
+      now,
+      livenessResolverWith([unconsumedAgentId]),
+    );
+
+    const result = await repository.listSubAgentActivitiesBySessionName(
+      [sessionName],
+      transcriptMapFor([sessionName]),
+    );
+
+    expect(result.get(sessionName)).toEqual([
+      {
+        label: `agent-${unconsumedAgentId}`,
+        silentSeconds: 360,
+        runningSeconds: 3600,
+        waitingOnExternalProcess: false,
+        finishedResultUnconsumed: true,
+      },
+    ]);
+  });
+
+  it('discards a finished sub-agent when the running-subagents record cannot be resolved', async () => {
+    const sessionName = 'https_//github_com/owner/repo/issues/9';
+    const finishedAgentId = 'aaabbbbcccc30003';
+    writeAgentTranscript(
+      sessionName,
+      finishedAgentId,
+      finishedEntries('2026-06-27T10:30:00.000Z'),
+      nowEpochSeconds - 5220,
+    );
+    const repository = new TranscriptSessionSubAgentActivityRepository(
+      createResolver(),
+      emptyProcessLister(),
+      now,
+      livenessResolverWith(null),
+    );
+
+    const result = await repository.listSubAgentActivitiesBySessionName(
+      [sessionName],
+      transcriptMapFor([sessionName]),
+    );
+
+    expect(result.size).toBe(0);
+  });
+
+  it('discards a finished sub-agent whose id has already been removed from the running-subagents record', async () => {
+    const sessionName = 'https_//github_com/owner/repo/issues/9';
+    const finishedAgentId = 'aaabbbbcccc30004';
+    writeAgentTranscript(
+      sessionName,
+      finishedAgentId,
+      finishedEntries('2026-06-27T10:30:00.000Z'),
+      nowEpochSeconds - 5220,
+    );
+    const repository = new TranscriptSessionSubAgentActivityRepository(
+      createResolver(),
+      emptyProcessLister(),
+      now,
+      livenessResolverWith(['aaabbbbcccc30005']),
+    );
+
+    const result = await repository.listSubAgentActivitiesBySessionName(
+      [sessionName],
+      transcriptMapFor([sessionName]),
+    );
+
+    expect(result.size).toBe(0);
+  });
+
+  it('reports a still-working sub-agent listed in the running-subagents record as having no unconsumed result', async () => {
+    const sessionName = 'https_//github_com/owner/repo/issues/9';
+    const workingAgentId = 'aaabbbbcccc30006';
+    writeAgentTranscript(
+      sessionName,
+      workingAgentId,
+      pendingToolUseEntries('2026-06-27T11:45:00.000Z'),
+      nowEpochSeconds - 600,
+    );
+    const repository = new TranscriptSessionSubAgentActivityRepository(
+      createResolver(),
+      emptyProcessLister(),
+      now,
+      livenessResolverWith([workingAgentId]),
+    );
+
+    const result = await repository.listSubAgentActivitiesBySessionName(
+      [sessionName],
+      transcriptMapFor([sessionName]),
+    );
+
+    expect(result.get(sessionName)).toEqual([
+      {
+        label: `agent-${workingAgentId}`,
+        silentSeconds: 600,
+        runningSeconds: 900,
+        waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ]);
   });

package/src/adapter/repositories/TranscriptSessionSubAgentActivityRepository.ts

@@ -344,6 +344,7 @@ export class TranscriptSessionSubAgentActivityRepository implements SessionSubAg
         filePath,
         fileName,
         nowEpochSeconds,
+        liveSubAgentIds !== null,
         loadNormalizedProcessCommandLines,
       );
       if (activity !== null) {
@@ -357,6 +358,7 @@ export class TranscriptSessionSubAgentActivityRepository implements SessionSubAg
     filePath: string,
     fileName: string,
     nowEpochSeconds: number,
+    listedInRunningSubAgentsRecord: boolean,
     loadNormalizedProcessCommandLines: () => Promise<string[]>,
   ): Promise<SubAgentActivity | null> => {
     let content: string;
@@ -368,7 +370,10 @@ export class TranscriptSessionSubAgentActivityRepository implements SessionSubAg
       return null;
     }
     const transcript = parseTranscript(content);
-    if (transcript.lastEntryIndicatesCompletion) {
+    if (
+      transcript.lastEntryIndicatesCompletion &&
+      !listedInRunningSubAgentsRecord
+    ) {
       return null;
     }
     const silentSeconds = clampToZero(
@@ -388,6 +393,7 @@ export class TranscriptSessionSubAgentActivityRepository implements SessionSubAg
           transcript.pendingToolCommands,
           loadNormalizedProcessCommandLines,
         )),
+      finishedResultUnconsumed: transcript.lastEntryIndicatesCompletion,
     };
   };
 

package/src/adapter/repositories/issue/ApiV3CheerioRestIssueRepository.test.ts

@@ -268,6 +268,114 @@ describe('ApiV3CheerioRestIssueRepository', () => {
     });
   });
 
+  describe('get', () => {
+    it('reads the single project item scoped to the given project without consulting the getAllIssues memo', async () => {
+      const {
+        repository,
+        graphqlProjectItemRepository,
+        localStorageCacheRepository,
+        projectRepository,
+        dateRepository,
+      } = createApiV3CheerioRestIssueRepository();
+      const project = buildTestProject('test-project-id');
+      dateRepository.now.mockResolvedValue(new Date('2026-07-07T00:00:00Z'));
+      localStorageCacheRepository.getSingle.mockResolvedValue(null);
+      projectRepository.getProject.mockResolvedValue(project);
+      graphqlProjectItemRepository.fetchProjectItems.mockResolvedValue([]);
+      localStorageCacheRepository.setSingle.mockResolvedValue();
+      graphqlProjectItemRepository.fetchProjectItemByUrl.mockResolvedValue(
+        buildProjectItem('https://github.com/o/r/issues/1', 'live title'),
+      );
+
+      await repository.getAllIssues('test-project-id');
+      const issue = await repository.get(
+        'https://github.com/o/r/issues/1',
+        project,
+      );
+
+      expect(issue?.title).toBe('live title');
+      expect(
+        graphqlProjectItemRepository.fetchProjectItemByUrl.mock.calls,
+      ).toEqual([['https://github.com/o/r/issues/1', 'test-project-id']]);
+    });
+
+    const issueUrlOnTwoProjects = 'https://github.com/o/r/issues/1';
+
+    const buildProjectScopedItem = (
+      itemId: string,
+      status: string,
+      story: string,
+      nextActionHour: string,
+    ): ProjectItem => ({
+      ...buildProjectItem(issueUrlOnTwoProjects, itemId),
+      id: itemId,
+      customFields: [
+        { name: 'Status', value: status },
+        { name: 'story', value: story },
+        { name: 'nextActionHour', value: nextActionHour },
+      ],
+    });
+
+    const itemOnOtherProject = buildProjectScopedItem(
+      'item-on-other-project',
+      'Awaiting Workspace',
+      'other story',
+      '9',
+    );
+    const itemOnRequestedProject = buildProjectScopedItem(
+      'item-on-requested-project',
+      'Preparation',
+      'requested story',
+      '17',
+    );
+
+    const arrangeItemsOnTwoProjects = (
+      graphqlProjectItemRepository: ReturnType<
+        typeof createApiV3CheerioRestIssueRepository
+      >['graphqlProjectItemRepository'],
+    ): void => {
+      const itemsByProjectId = new Map<string, ProjectItem>([
+        ['other-project-id', itemOnOtherProject],
+        ['requested-project-id', itemOnRequestedProject],
+      ]);
+      graphqlProjectItemRepository.fetchProjectItemByUrl.mockImplementation(
+        async (_issueUrl: string, projectId?: string) =>
+          projectId === undefined
+            ? Array.from(itemsByProjectId.values())[0]
+            : (itemsByProjectId.get(projectId) ?? null),
+      );
+    };
+
+    it('returns the project item of the requested project when the issue is on two projects', async () => {
+      const { repository, graphqlProjectItemRepository } =
+        createApiV3CheerioRestIssueRepository();
+      arrangeItemsOnTwoProjects(graphqlProjectItemRepository);
+
+      const issue = await repository.get(
+        issueUrlOnTwoProjects,
+        buildTestProject('requested-project-id'),
+      );
+
+      expect(issue?.itemId).toBe('item-on-requested-project');
+      expect(issue?.status).toBe('Preparation');
+      expect(issue?.story).toBe('requested story');
+      expect(issue?.nextActionHour).toBe(17);
+    });
+
+    it('returns null when the issue has project items only on other projects', async () => {
+      const { repository, graphqlProjectItemRepository } =
+        createApiV3CheerioRestIssueRepository();
+      arrangeItemsOnTwoProjects(graphqlProjectItemRepository);
+
+      const issue = await repository.get(
+        issueUrlOnTwoProjects,
+        buildTestProject('project-without-any-item'),
+      );
+
+      expect(issue).toBeNull();
+    });
+  });
+
   describe('getAllIssues incremental fetch', () => {
     it('light-scans the lastFetchedAt UTC day with no previous-day overlap, detail-fetches changed items by id, and upserts by url', async () => {
       const {

package/src/adapter/repositories/issue/ApiV3CheerioRestIssueRepository.ts

@@ -911,8 +911,16 @@ export class ApiV3CheerioRestIssueRepository
   searchIssues = (query: string): Promise<SearchedIssue[]> => {
     return this.restIssueRepository.searchIssues(query);
   };
-  get = async (_issueUrl: string, _project: Project): Promise<Issue | null> => {
-    return this.getIssueByUrl(_issueUrl);
+  get = async (issueUrl: string, project: Project): Promise<Issue | null> => {
+    const projectItem =
+      await this.graphqlProjectItemRepository.fetchProjectItemByUrl(
+        issueUrl,
+        project.id,
+      );
+    if (!projectItem) {
+      return null;
+    }
+    return this.convertProjectItemToIssue(projectItem);
   };
   update = async (issue: Issue, _project: Project): Promise<void> => {
     await this.updateIssue(issue);

package/src/domain/entities/KevReportWatermark.ts

@@ -0,0 +1,4 @@
+export type KevReportWatermark = {
+  lastReportedDateAdded: string;
+  reportedCveIdsOnLastReportedDateAdded: string[];
+};

package/src/domain/entities/LiveSessionActivitySnapshot.ts

@@ -3,6 +3,7 @@ export type SubAgentActivity = {
   silentSeconds: number;
   runningSeconds: number;
   waitingOnExternalProcess: boolean;
+  finishedResultUnconsumed: boolean;
 };
 
 export type LiveSessionActivitySnapshot = {

package/src/domain/usecases/DailySecurityScanUseCase.test.ts

@@ -2,6 +2,7 @@ import { DailySecurityScanUseCase } from './DailySecurityScanUseCase';
 import { LocalCommandRunner } from './adapter-interfaces/LocalCommandRunner';
 import { IssueRepository } from './adapter-interfaces/IssueRepository';
 import { HttpRepository } from './adapter-interfaces/HttpRepository';
+import { KevReportWatermarkRepository } from './adapter-interfaces/KevReportWatermarkRepository';
 import { mock } from 'jest-mock-extended';
 
 const KEV_CATALOG_URL =
@@ -12,16 +13,21 @@ describe('DailySecurityScanUseCase', () => {
     const mockLocalCommandRunner = mock<LocalCommandRunner>();
     const mockIssueRepository = mock<IssueRepository>();
     const mockHttpRepository = mock<HttpRepository>();
+    const mockKevReportWatermarkRepository =
+      mock<KevReportWatermarkRepository>();
+    mockKevReportWatermarkRepository.load.mockResolvedValue({ type: 'absent' });
     const useCase = new DailySecurityScanUseCase(
       mockLocalCommandRunner,
       mockIssueRepository,
       mockHttpRepository,
+      mockKevReportWatermarkRepository,
     );
     return {
       useCase,
       mockLocalCommandRunner,
       mockIssueRepository,
       mockHttpRepository,
+      mockKevReportWatermarkRepository,
     };
   };
 
@@ -1238,5 +1244,209 @@ describe('DailySecurityScanUseCase', () => {
       );
       expect(grepCalls).toHaveLength(0);
     });
+
+    const scannedExampleLibrary = osvScanOutput([
+      {
+        name: 'example-library',
+        version: '1.2.3',
+        ecosystem: 'npm',
+        id: 'GHSA-1111-2222-3333',
+        aliases: ['CVE-2024-0001', 'CVE-2024-0002', 'CVE-2024-0003'],
+        summary: 'Example Library Deserialization',
+      },
+    ]);
+
+    const kevCatalogOf = (
+      vulnerabilities: { cveID: string; dateAdded: string }[],
+    ) => ({
+      vulnerabilities: vulnerabilities.map((vulnerability) => ({
+        cveID: vulnerability.cveID,
+        vendorProject: 'Example',
+        product: 'ExampleLibrary',
+        vulnerabilityName: `${vulnerability.cveID} Deserialization`,
+        dateAdded: vulnerability.dateAdded,
+      })),
+    });
+
+    it('records every addition it considered in the watermark after the report issue is created', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([
+            { cveID: 'CVE-2024-0001', dateAdded: '2024-01-01' },
+            { cveID: 'CVE-2024-0002', dateAdded: '2024-01-02' },
+          ]),
+        );
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(1);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toEqual([
+        [
+          {
+            lastReportedDateAdded: '2024-01-02',
+            reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-0002'],
+          },
+        ],
+      ]);
+    });
+
+    it('does not report an addition that the stored watermark already covers', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' }]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'stored',
+        watermark: {
+          lastReportedDateAdded: '2024-01-02',
+          reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-0001'],
+        },
+      });
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toHaveLength(0);
+    });
+
+    it('reports an addition sharing the stored watermark date that was not reported before', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([
+            { cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' },
+            { cveID: 'CVE-2024-0002', dateAdded: '2024-01-02' },
+          ]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'stored',
+        watermark: {
+          lastReportedDateAdded: '2024-01-02',
+          reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-0001'],
+        },
+      });
+
+      await runWithKevReporting(useCase);
+
+      const kevCalls = kevReportCalls(
+        mockIssueRepository.createNewIssue.mock.calls,
+      );
+      expect(kevCalls).toHaveLength(1);
+      expect(kevCalls[0][3]).toContain('CVE-2024-0002');
+      expect(kevCalls[0][3]).not.toContain('CVE-2024-0001');
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toEqual([
+        [
+          {
+            lastReportedDateAdded: '2024-01-02',
+            reportedCveIdsOnLastReportedDateAdded: [
+              'CVE-2024-0001',
+              'CVE-2024-0002',
+            ],
+          },
+        ],
+      ]);
+    });
+
+    it('does not select an addition dated strictly before the stored watermark date', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-01' }]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'stored',
+        watermark: {
+          lastReportedDateAdded: '2024-01-02',
+          reportedCveIdsOnLastReportedDateAdded: [],
+        },
+      });
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toHaveLength(0);
+    });
+
+    it('advances the watermark over an addition that affects no scanned package so it is not weighed again', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-9999', dateAdded: '2024-01-02' }]),
+        );
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toEqual([
+        [
+          {
+            lastReportedDateAdded: '2024-01-02',
+            reportedCveIdsOnLastReportedDateAdded: ['CVE-2024-9999'],
+          },
+        ],
+      ]);
+    });
+
+    it('skips the report and leaves the watermark untouched when the stored watermark is unreadable', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' }]),
+        );
+      mockKevReportWatermarkRepository.load.mockResolvedValue({
+        type: 'unreadable',
+        reason: 'the stored watermark file holds malformed JSON',
+      });
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(0);
+      expect(mockKevReportWatermarkRepository.save.mock.calls).toHaveLength(0);
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          'the stored watermark file holds malformed JSON',
+        ),
+      );
+      errorSpy.mockRestore();
+    });
+
+    it('creates the report issue and logs when the watermark write fails, so the same additions are weighed again', async () => {
+      const { useCase, mockIssueRepository, mockKevReportWatermarkRepository } =
+        buildScanEnvironment(
+          scannedExampleLibrary,
+          kevCatalogOf([{ cveID: 'CVE-2024-0001', dateAdded: '2024-01-02' }]),
+        );
+      mockKevReportWatermarkRepository.save.mockRejectedValue(
+        new Error('disk is read-only'),
+      );
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => {});
+
+      await runWithKevReporting(useCase);
+
+      expect(
+        kevReportCalls(mockIssueRepository.createNewIssue.mock.calls),
+      ).toHaveLength(1);
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('disk is read-only'),
+      );
+      errorSpy.mockRestore();
+    });
   });
 });